[glibc] manual: Document default AT_SECURE handling for system-wide tunables

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3a9c4dbe307d8d2b40fc4a54339c203cdf89af00

commit 3a9c4dbe307d8d2b40fc4a54339c203cdf89af00
Author: Adhemerval Zanella <[email protected]>
Date:   Mon Jul 6 11:48:23 2026 -0300

    manual: Document default AT_SECURE handling for system-wide tunables
    
    A system-wide tunable without an onlysecure/nonsecure/anysecure prefix
    defaults to "nonsecure", i.e. it is not applied to AT_SECURE processes.
    This is a deliberate, conservative default but was not documented.
    
    Reviewed-by: DJ Delorie <[email protected]>

Diff:
---
 manual/tunables.texi | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/manual/tunables.texi b/manual/tunables.texi
index 828c68151a..e7dcef1040 100644
--- a/manual/tunables.texi
+++ b/manual/tunables.texi
@@ -143,6 +143,22 @@ processes.
 
 @end table
 
+When none of the @code{onlysecure}, @code{nonsecure} or @code{anysecure}
+prefixes is given, a tunable behaves as if @code{nonsecure} had been
+specified: it applies only to processes that are not AT_SECURE.  Use
+@code{anysecure} or @code{onlysecure} to affect AT_SECURE (setuid,
+setgid, or capability-elevated) processes.
+
+The @code{GLIBC_TUNABLES} environment variable is ignored entirely for
+AT_SECURE processes, so the system-wide file is the only way to set a
+tunable for such a process.  A tunable applied this way is not subject to
+any per-tunable security screening, so @code{onlysecure} and
+@code{anysecure} must be used deliberately: they can enable
+security-sensitive tunables (for example @code{glibc.malloc.check}) in
+every setuid or setgid program.  The config file is therefore trusted to
+the same degree as @file{/etc/ld.so.cache} and must only be writable by
+the system administrator.
+
 Filters make the system-wide tunables only affect certain programs.
 This allows having a non-overridable default for most of the system
 but a different, overridable, value for certain programs that might